Malicious PDF — malware analysis report

Static analysis result for SHA-256 9993ffcde92af543…

MALICIOUS

PDF

176.0 KB Created: 2021-05-30 20:44:33 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: af98a4aa03eebe88d0a2d1678a1dc913 SHA-1: e6faeaa38403f4701aa2869122c1a9b799dbf049 SHA-256: 9993ffcde92af543d8cb861db911c5944c19c9d8a154a6b0e53990a828b4beef
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, specifically as a phishing trojan. It contains an embedded URL pointing to 'druttle.ru', which is likely a distribution point for malware or a phishing page, disguised as a free PDF download. The PDF structure itself is also flagged for suspicious object duplication.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9983

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/strik?utm_term=hamlet+in+modern+english+free+pdf
    • https://cdn-cms.f-static.net/uploads/4417029/normal_605f9d9ca6545.pdf
    • https://zugogulubituwo.weebly.com/uploads/1/3/4/2/134266111/f59b806.pdf
    • https://static.s123-cdn-static.com/uploads/4422908/normal_6008b14f61703.pdf
    • https://cdn-cms.f-static.net/uploads/4417644/normal_5fe80e97d43ec.pdf
    • https://cdn-cms.f-static.net/uploads/4419640/normal_606779a16c33f.pdf
    • https://wobakasufafe.weebly.com/uploads/1/3/2/6/132682589/bagudaxiwizijades.pdf
    • https://cdn-cms.f-static.net/uploads/4475866/normal_5fd6395a8f32a.pdf
    • https://static.s123-cdn-static.com/uploads/4528780/normal_5fff15ceaaaca.pdf
    • https://cdn-cms.f-static.net/uploads/4381962/normal_602b0df7d9ab0.pdf
    • https://cdn-cms.f-static.net/uploads/4389127/normal_6015840311bb5.pdf
    • https://static.s123-cdn-static.com/uploads/4366359/normal_60031839b18b7.pdf
    • https://zoxobafibo.weebly.com/uploads/1/3/4/2/134235835/podonobizewin-kutadozewupat.pdf
    • https://cdn-cms.f-static.net/uploads/4469116/normal_6015d90655b99.pdf
    • https://pofekivivefuron.weebly.com/uploads/1/3/5/3/135339802/valokozitaru.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/123d706d-4d0d-4760-b429-dde066fc360f/23779075671.pdf
    • https://uploads.strikinglycdn.com/files/df757d4e-8777-4050-b46d-0ab1ef2e33f2/kenmore_600s_washer_troubleshooting.pdf
    • https://uploads.strikinglycdn.com/files/c15c6f49-43a3-4b21-b42f-c2e1f7320fd2/suzepot.pdf
    • https://uploads.strikinglycdn.com/files/65655c8f-e490-4d3a-b967-bd0817e5b4f5/ashtalakshmi_stotram_in_english_with_meaning.pdf
    • https://uploads.strikinglycdn.com/files/00f3f21d-9d29-49b0-9d94-e5cf6d5c73ee/kidodujugajaje.pdf
    • https://uploads.strikinglycdn.com/files/d5f0c121-a6fb-416b-84af-a6b5a20d1aff/chaos_james_gleick_summary.pdf
    • https://uploads.strikinglycdn.com/files/25e06115-ea2c-402b-8ccb-7a604d2ca519/96576516734.pdf
    • https://uploads.strikinglycdn.com/files/dc4ced4d-3766-4427-b67e-919a43308a6f/celestron_astromaster_70_user_guide.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00027529.bin
ac6dbae6a9585fa6c455855a6fe67f6e6fa9bf3131cd20e4bdd1e06f18afe7e0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x27529 5416 bytes
font_01_sfnt_off00028769.bin
10244bf6f67f11a30362f902fb6d4bde24fc0bd7e0186b6e5602e879d970c93d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x28769 12884 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.